Extracted

Extracted

• • Target

    7aaee224559608d8c305b6016b0461200dc88758ef46374b1eb3df3a8cc6114d

  • Size

    533KB

  • MD5

    6686c2e73f606bb17d692fe1219f10f0

  • SHA1

    2cedfceb62c28cea0792af906ef6a4311a18cd04

  • SHA256

    7aaee224559608d8c305b6016b0461200dc88758ef46374b1eb3df3a8cc6114d

  • SHA512

    b55620234bb0d4a4510c0482ed174820693175e6d680d93bdab8a8c010c5fd1d7309e8820ecbd94fd8b15cb86e366a9a8f6f9c1d480a1727fc6221e727742b30

  • SSDEEP

    12288:eMrCy90PPR0CiCK4P7Q97PIzR653LqwBddzsOPrWg64:oysPBK4jQ9Li653GG/vrWq

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1